1. Home
  2. CVE Database
  3. CVE-2022-25768
HIGH · 7.0

CVE-2022-25768

The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possi...

Vulnerability Description

The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possible for an attacker to access the Mautic version number or to execute parts of the upgrade process without permission. As upgrading in the user interface is deprecated, this functionality is no longer required.

CVSS Score

7.0

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
HIGH

Affected Products

VendorProductVersions
AcquiaMautic>= 1.1.3, < 4.4.13

Related Weaknesses (CWE)

CWE-287CWE-862

References

FAQ

What is CVE-2022-25768?

CVE-2022-25768 is a vulnerability with a CVSS score of 7.0 (HIGH). The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be possi...

How severe is CVE-2022-25768?

CVE-2022-25768 has been rated HIGH with a CVSS base score of 7.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-25768?

Check the references section above for vendor advisories and patch information. Affected products include: Acquia Mautic.